Penetration Testing mailing list archives
RE: Hardcoded Database IP in ASP
From: "Ken Schaefer" <Ken () adOpenStatic com>
Date: Mon, 18 Sep 2006 16:54:05 +1000
: -----Original Message----- : From: listbounce () securityfocus com : [mailto:listbounce () securityfocus com] On Behalf Of Darryl Stevens : Subject: Hardcoded Database IP in ASP : : Question: I have ASP script that points to a backend database residing : on separate physical server. Is there any known way of getting around : using a hard-coded IP address to point to the database? Would : utilizing the OS hosts file serve my purposes of and satisfy : secure code practices? Thanks guys. : : Darryl What threats, exactly, are you trying to secure against here? You are changing from having the DB server's IP address directly in your code to using a hostname in your code, and storing the corresponding IP address in the hosts file. Are you afraid someone might get hold of the IP address? If they did get this IP address, what would they do with it? And would storing it in a hosts file help? A malicious attacker could simply connect using the hostname, and Windows will resolve it to the IP address via a hosts file lookup... Cheers Ken ------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php ------------------------------------------------------------------------
Current thread:
- Hardcoded Database IP in ASP Darryl Stevens (Sep 14)
- Re: Hardcoded Database IP in ASP RSnake (Sep 15)
- RE: Hardcoded Database IP in ASP Ken Schaefer (Sep 18)
- <Possible follow-ups>
- RE: Hardcoded Database IP in ASP William Woodhams (Sep 15)
- RE: Hardcoded Database IP in ASP Darryl Stevens (Sep 15)